com.47deg:freestyle-http-http4s_2.11 (0.1.0), com.azavea.geotrellis:geotrellis-server-core_2.11 (>=4.0.1, <=4.2.0) +197 more potentially affected by CVE-2025-58369 via co.fs2:fs2-io_2.11 (>=0.9.1, <=2.1.0)

co.fs2:fs2-io2.11 MAVEN version =0.9.1, =4.0.1, =4.0.1, =4.0.1, =0.4.0, =0.4.0, =5.0.0-m1, =1.3.0, =0.1.0, =0.0.2, =0.12.7, =0.12.7, =0.12.7, =0.14.1, =0.16.1 and more Source cves: CVE-2025-58369 Source advisory: SNYK:JAVA-COFS2-13180115...

com.github.barambani:http4s-extend_2.12 (>=0.0.24, <=0.0.32), com.github.gvolpe:http4s-tracer_2.12 (0.1) +63 more potentially affected by CVE-2025-58369 via co.fs2:fs2-io_2.12 (0.10.3)

co.fs2:fs2-io2.12 MAVEN version 0.10.3 is affected by a known vulnerability. The following packages have a transitive dependency on co.fs2:fs2-io2.12 and may be impacted: - com.github.barambani:http4s-extend2.12 =0.0.24, =0.5.0, =0.11.0, =0.3, =0.1.0, =0.1.0, =0.1.0, =0.1.5, =0.1.6 -...

com.github.barambani:http4s-extend_2.11 (>=0.0.24, <=0.0.32), com.github.gvolpe:http4s-tracer_2.11 (0.1) +51 more potentially affected by CVE-2025-58369 via co.fs2:fs2-io_2.11 (0.10.3)

co.fs2:fs2-io2.11 MAVEN version 0.10.3 is affected by a known vulnerability. The following packages have a transitive dependency on co.fs2:fs2-io2.11 and may be impacted: - com.github.barambani:http4s-extend2.11 =0.0.24, =0.11.0, =0.3, =0.1.1, =0.1.1, =0.1.1, =0.1.5, =0.0.1-m10, =0.0.1-m10,...

com.qvantel:jsonapi-scala-http4s-client_2.11 (>=6.0.1, <=6.1.0), org.http4s:http4s-argonaut_2.11 (0.18.0-m6) +21 more potentially affected by CVE-2025-58369 via co.fs2:fs2-io_2.11 (0.10.0-m9)

co.fs2:fs2-io2.11 MAVEN version 0.10.0-m9 is affected by a known vulnerability. The following packages have a transitive dependency on co.fs2:fs2-io2.11 and may be impacted: - com.qvantel:jsonapi-scala-http4s-client2.11 =6.0.1, =6.1.0 - org.http4s:http4s-argonaut2.11 0.18.0-m6 -...

com.qvantel:jsonapi-scala-http4s-client_2.12 (>=6.0.1, <=6.1.0), org.aws4s:aws4s_2.12 (>=0.2.0, <=0.5.0) +22 more potentially affected by CVE-2025-58369 via co.fs2:fs2-io_2.12 (0.10.0-m9)

co.fs2:fs2-io2.12 MAVEN version 0.10.0-m9 is affected by a known vulnerability. The following packages have a transitive dependency on co.fs2:fs2-io2.12 and may be impacted: - com.qvantel:jsonapi-scala-http4s-client2.12 =6.0.1, =0.2.0, =0.5.0 - org.http4s:http4s-argonaut2.12 0.18.0-m6 -...

com.github.agourlay:cornichon-core_2.12 (0.15.0), com.github.agourlay:cornichon-experimental_2.12 (0.15.0) +33 more potentially affected by CVE-2025-58369 via co.fs2:fs2-io_2.12 (0.10.0-m11)

co.fs2:fs2-io2.12 MAVEN version 0.10.0-m11 is affected by a known vulnerability. The following packages have a transitive dependency on co.fs2:fs2-io2.12 and may be impacted: - com.github.agourlay:cornichon-core2.12 0.15.0 - com.github.agourlay:cornichon-experimental2.12 0.15.0 -...

com.github.barambani:http4s-extend_2.11 (0.0.43), com.github.pureconfig:pureconfig-http4s_2.11 (0.10.2) +31 more potentially affected by CVE-2025-58369 via co.fs2:fs2-io_2.11 (0.10.6)

co.fs2:fs2-io2.11 MAVEN version 0.10.6 is affected by a known vulnerability. The following packages have a transitive dependency on co.fs2:fs2-io2.11 and may be impacted: - com.github.barambani:http4s-extend2.11 0.0.43 - com.github.pureconfig:pureconfig-http4s2.11 0.10.2 -...

GHSA-RRW2-PX9J-QFFJ FS2 half-shutdown of socket during TLS handshake may result in spin loop on opposite side

Impact When establishing a TLS session using fs2-io on the JVM using the fs2.io.net.tls package, if one side of the connection shuts down write while the peer side is awaiting more data to progress the TLS handshake, the peer side will spin loop on the socket read, fully utilizing a CPU. This CPU...

com.spinoco:fs2-http_2.11 (0.2.0-rc1), io.frees:frees-http-http4s_2.11 (0.4.0) +23 more potentially affected by CVE-2025-58369 via co.fs2:fs2-io_2.11 (0.10.0-m6)

co.fs2:fs2-io2.11 MAVEN version 0.10.0-m6 is affected by a known vulnerability. The following packages have a transitive dependency on co.fs2:fs2-io2.11 and may be impacted: - com.spinoco:fs2-http2.11 0.2.0-rc1 - io.frees:frees-http-http4s2.11 0.4.0 - io.frees:frees-http4s2.11 =0.4.1, =0.18.0-m1,...

com.qvantel:jsonapi-scala-http4s-client_2.11 (6.0.0), io.frees:frees-http4s_2.11 (>=0.4.5, <=0.5.0) +22 more potentially affected by CVE-2025-58369 via co.fs2:fs2-io_2.11 (0.10.0-m8)

co.fs2:fs2-io2.11 MAVEN version 0.10.0-m8 is affected by a known vulnerability. The following packages have a transitive dependency on co.fs2:fs2-io2.11 and may be impacted: - com.qvantel:jsonapi-scala-http4s-client2.11 6.0.0 - io.frees:frees-http4s2.11 =0.4.5, =0.5.0 -...

com.github.allantl:atlassian-connect-http4s_2.12 (>=0.1.0, <=0.1.2), com.github.allantl:jira4s_2.12 (0.2.0) +291 more potentially affected by CVE-2025-53864 via com.nimbusds:nimbus-jose-jwt (7.1)

com.nimbusds:nimbus-jose-jwt MAVEN version 7.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - com.github.allantl:atlassian-connect-http4s2.12 =0.1.0, =1.4, =0.29.0, =0.29.0, =0.29.0, =0.29.0, =0.29.0...

CVE-2021-21294

Http4s http4s-blaze-server is a minimal, idiomatic Scala interface for HTTP services. Http4s before versions 0.21.17, 0.22.0-M2, and 1.0.0-M14 have a vulnerability which can lead to a denial-of-service. Blaze-core, a library underlying http4s-blaze-server, accepts connections unboundedly on its...

CVE-2021-21293

blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. All servers running blaze-core before version 0.14.15 are affected by a vulnerability in which unbounded connection acceptance leads to file handle exhaustion. Blaze, accepts connections unconditionally on a...

CVE-2021-32643

Http4s is a Scala interface for HTTP services. StaticFile.fromUrl can leak the presence of a directory on a server when the URL scheme is not file://, and the URL points to a fetchable resource under its scheme and authority. The function returns FNone, indicating no resource, if url.getFile is a...

CVE-2020-5280

http4s before versions 0.18.26, 0.20.20, and 0.21.2 has a local file inclusion vulnerability. This vulnerability applies to all users of org.http4s.server.staticcontent.FileService, org.http4s.server.staticcontent.ResourceService and org.http4s.server.staticcontent.WebjarService. URI normalizatio...

org.apache.tomcat:tomcat-catalina-ha (8.0.37), org.apache.tomcat:tomcat-catalina-jmx-remote (8.0.37) +4 more potentially affected by CVE-2024-52316 via org.apache.tomcat:tomcat-catalina (8.0.37)

org.apache.tomcat:tomcat-catalina MAVEN version 8.0.37 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat:tomcat-catalina and may be impacted: - org.apache.tomcat:tomcat-catalina-ha 8.0.37 - org.apache.tomcat:tomcat-catalina-jmx-remote...

ch.j3t:zio-prefetcher_2.13 (0.8.0-rc6), com.47deg:energy-monitor-persistence-app_2.13 (0.2.0) +246 more potentially affected by CVE-2023-22465 via org.http4s:http4s-core_2.13 (>=0.23.0, <=0.23.16)

org.http4s:http4s-core2.13 MAVEN version =0.23.0, =0.29.1, =0.31.0, =0.4.0, =0.9.0, =0.9.0, =0.0-a75a626, =0.0-a75a626, =0.1-0b4f7b6, =0.31.0, =0.31.2 and more Source cves: CVE-2023-22465 Source advisory: GHSA-54W6-VXFH-FW7F...

ch.j3t:zio-prefetcher_2.12 (0.7.0), com.47deg:memeid4s-http4s_2.12 (0.3.0) +109 more potentially affected by CVE-2023-22465 via org.http4s:http4s-core_2.12 (>=0.22.0, <=0.22.14)

org.http4s:http4s-core2.12 MAVEN version =0.22.0, =0.8.0, =0.8.0, =0.18.8, =0.17.0, =0.17.0, =0.12.0, =0.17.0, =0.12.0, =0.17.0, =0.12.0, =0.12.0, =0.18.4 and more Source cves: CVE-2023-22465 Source advisory: GHSA-54W6-VXFH-FW7F...

ch.epfl.bluebrain.nexus:cli_2.13 (>=1.5.0-rc4, <=1.6.1), ch.j3t:zio-prefetcher_2.13 (>=0.3.0, <=0.6.0) +326 more potentially affected by CVE-2023-22465 via org.http4s:http4s-core_2.13 (>=0.10.0-m10, <=0.21.33)

org.http4s:http4s-core2.13 MAVEN version =0.10.0-m10, =1.5.0-rc4, =0.3.0, =0.22.0, =0.2.0, =0.2.0, =0.1.0, =1.3.1, =1.3.1, =0.6.1, =0.13.1, =0.11.2, =0.12.1, =0.7.2, =0.13.2 and more Source cves: CVE-2023-22465 Source advisory: OSV:GHSA-54W6-VXFH-FW7F...

ch.j3t:zio-prefetcher_2.12 (>=0.3.0, <=0.6.0), com.47deg:embedded-cassandra-core_2.12 (0.0.7) +375 more potentially affected by CVE-2023-22465 via org.http4s:http4s-core_2.12 (>=0.10.0-m10, <=0.21.33)

org.http4s:http4s-core2.12 MAVEN version =0.10.0-m10, =0.3.0, =0.22.0, =0.13.2, =0.2.6, =0.3.0, =0.2.0, =0.1.0, =0.6.1, =0.6.1, =0.18.1, =0.18.7 - com.avast:datadog4s-http4s2.12 0.6.0 - com.avast:datadog4s2.12 0.6.0 and more Source cves: CVE-2023-22465 Source advisory: OSV:GHSA-54W6-VXFH-FW7F...